1 / 47

Cryptography

Cryptography. Lecture 11: Oct 12. Cryptography. Cryptography is the study of methods for sending and receiving secret messages. Alice. Bob. message. adversary. Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was.

quon-blevins
Download Presentation

Cryptography

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Cryptography Lecture 11: Oct 12

  2. Cryptography Cryptography is the study of methods for sending and receiving secret messages. Alice Bob message adversary Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was.

  3. Cryptography Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was. f(message) Alice Bob encrypt the message decrypt the message adversary message -> f(message) f(message) -> message But the adversary has no clue how to obtain message from f(message) A difficult goal!

  4. Key Goal: Even though an adversary can listen to your conversation, the adversary can not learn what the message was. f(message, key) Alice Bob encrypt the message using the key decrypt the message using the key adversary message -> f(message,key) f(message,key) -> message But the adversary can not decrypt f(message,key) without the key Use number theory!

  5. Turing’s Code (Version 1.0) The first step is to translate a message into a number “v i c t o r y” -> 22 09 03 20 15 18 25 Beforehand The sender and receiver agree on a secret key, which is a large number k. Encryption The sender encrypts the message m by computing: m* = m · k Decryption The receiver decrypts m by computing: m*/k = m · k/k = m

  6. Turing’s Code (Version 1.0) mk Alice Bob m = message k = key encrypted message = mk mk = received message k = key decrypted message = mk/k=m adversary Why the adversary cannot figure out m? The adversary doesn’t have the key k, and so can only factor mk to figure out m, but factoring is a difficult task to do.

  7. Turing’s Code (Version 1.0) mk Alice Bob m = message k = key encrypted message = mk mk = received message k = key decrypted message = mk/k=m adversary So why don’t we use this Turing’s code today? Major flaw: if you use the same key to send two messages m and m’, then from mk and m’k, we can use gcd(mk,m’k) to figure out k, and then decrypt every message.

  8. Turing’s Code (Version 2.0) Beforehand The sender and receiver agree on a large prime p, which may be made public. (This will be the modulus for all our arithmetic.) They also agree on a secret key k in {1, 2, . . . , p − 1}. Encryption The message m can be any integer in the set {0, 1, 2, . . . , p − 1}. The sender encrypts the message m to produce m* by computing: m* = mk mod p Decryption Let k’ be the multiplicative inverse of k under modulo p. m*  mk (mod p) m*k’  m (mod p) m*k’ = m

  9. Turing’s Code (Version 2.0) Public information p Alice Bob m* = mk mod p m = message k = key encrypted message = mk mod p m* = received message k = key decrypted message = m*k’ =m adversary Why the adversary cannot figure out m? Many m and k can produce m* as output, just impossible to determine m without k.

  10. Turing’s Code (Version 2.0) Public information p Alice Bob m* = mk mod p m = message k = key encrypted message = mk mod p m* = received message k = key decrypted message = m*k’ =m adversary So why don’t we use this Turing’s code today? If the adversary somehow knows m, then first compute m’ := multiplicative inverse of m m*  mk (mod p) m*m’  k (mod p) So the adversary can figure out k. plain-text attack

  11. Private Key Cryptosystem f(message, key) Alice Bob encrypt the message using the key decrypt the message using the key adversary message -> f(message,key) f(message,key) -> message But the adversary can not decrypt f(message,key) without the key Two parties have to agree on a secret key, which may be difficult in practice. If we buy books from Amazon, we don’t need to exchange a secret code. Why is it secure?

  12. Public Key Cryptosystem Public information: Key for Alice Public information: Key for Bob f(message, Bob’s key) Alice Bob encrypt the message using Bob’s key decrypt the message adversary f(message,Bob’s key) -> message message -> f(message,Bob’s key) But the adversary can not decrypt f(message, Bob’s key)! Only Bob can decrypt the message sent to him! There is no need to have a secret key between Alice and Bob. How is it possible???

  13. RSA Cryptosystem RSA are the initials of three Computer Scientists, Ron Rivest, Adi Shamir and Len Adleman, who discovered their algorithm when they were working together at MIT in 1977.

  14. Generating Public Key public key: e and n Alice Bob secret key: d How Bob create his public keys? Secret key only known to Bob. • Choose 2 large prime numbers p and q. • Set n = pq and T = (p-1)(q-1) • Choose e ≠1 so that gcd(e,T)=1 • Calculate d so that de = 1 (mod T) • Publish e and n as public keys • Keep d as secret key > 150 digits

  15. Encrypting Message message x public key: e and n Send y = xe mod n Alice Bob secret key: d How Alice sends a message to Bob? • Look at Bob’s homepage for e and n. • Send y = xe mod n Alice does not need to know Bob’s secret key to send the message.

  16. Decrypting Message message x public key: e and n Send y = xe mod n Alice Bob secret key: d How Bob recover Alice’s message? • Receive y = xe mod n • Compute z = yd mod n Bob uses z is the original message that Alice sent.

  17. RSA Cryptosystem message x public key: e and n Send y = xe mod n Alice Bob Encrypting message secret key: d Key generation • Choose 2 large prime numbers p and q. • Set n = pq and T = (p-1)(q-1) • Choose e ≠1 so that gcd(e,T)=1 • Calculate d so that de = 1 (mod T) • Publish e and n as public keys • Keep d as secret key Decrypting message Compute z = yd mod n

  18. RSA Cryptosystem message x public key: e and n Send y = xe mod n Alice Bob secret key: d For the RSA cryptosytem to work, we need to show: 1)z = x 2) Without the secret key d, we can not compute the original message before the sun burns out. Compute z = yd mod n with additional assumptions…

  19. Correctness message x public key: e and n Send y = xe mod n Alice Bob secret key: d 1)z = x Compute z = yd mod n Note that z = yd mod n = xed mod n. Therefore we need to prove x = xed mod n. p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) (a)x mod p =xed mod p (b)x mod q =xed mod q (c)x mod n =xed mod n Therefore, if Alice sends x < n, then Bob can recover correctly.

  20. Correctness message x public key: e and n Send y = xe mod n Alice Bob secret key: d 1)z = x (a)x mod p =xed mod p Compute z = yd mod n = 1 + k(p-1)(q-1) Note that de = 1 + kT p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) Hence, xed mod p =x1+k(p-1)(q-1) mod p =x·xk(p-1)(q-1) mod p =x·(xk(q-1))(p-1) mod p

  21. Correctness message x public key: e and n Send y = xe mod n Alice Bob secret key: d 1)z = x (a)x mod p =xed mod p Compute z = yd mod n Fermat’s little theorem: If p | a, then ap-1 1 mod p p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) Hence, xed mod p =x1+k(p-1)(q-1) mod p =x·xk(p-1)(q-1) mod p =x·(xk(q-1))(p-1) mod p =x mod p a

  22. Correctness message x public key: e and n Send y = xe mod n Alice Bob secret key: d 1)z = x (a)x mod p =xed mod p Compute z = yd mod n This means p | xk(q-1), implying p | x, since p is prime p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) Hence, xed mod p =x1+k(p-1)(q-1) mod p =x·xk(p-1)(q-1) mod p =x·(xk(q-1))(p-1) mod p What if p | a? a Since p | x, we have xed mod p = x mod p = 0.

  23. Correctness message x public key: e and n Send y = xe mod n Alice Bob secret key: d 1)z = x Compute z = yd mod n Note that z = yd mod n = xed mod n. Therefore we need to prove x = xed mod n. p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) (a)x mod p =xed mod p (b)x mod q =xed mod q (c)x mod n =xed mod n The same proof. (c) can be proved directly, also follows from Chinese Remainder theorem.

  24. Why is this Secure? message x public key: e and n Send y = xe mod n Alice Bob adversary secret key: d 2) Without the secret key d, we can not compute the original message before the sun burns out. Compute z = yd mod n p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) Method 1: From y=xe mod n, don’t know how to compute x. Thus not possible to work backward. It is an example of an “one-way” function.

  25. Why is this Secure? message x public key: e and n Send y = xe mod n Alice Bob adversary secret key: d Compute z = yd mod n 2) Without the secret key d, we can not compute the original message before the sun burns out. p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) Method 2: Factor n = pq. Compute secrete key d. Then decrypt everything! No one knows an efficient way to do factoring. The security is based on assumptions that some computational problems are hard.

  26. RSA Example message x public key: e and n Send y = xe mod n Alice Bob secret key: d Then Alice sends the encrypted message. Compute z = yd mod n x=33 y = 3323 mod 55 p=5 q=11 n = 55 T = 40 e = 7 d = 23 p, q prime n = pq T = (p-1)(q-1) e s.t. gcd(e,T)=1 de = 1 (mod T) y = 84298649517881922539738734663399137 mod 55 How to compute it efficiently? Bob also need to compute similar function. We don’t want the sun burns out before we can encrypt and decrypt. First Bob generated his keys.

  27. Exponentiation To compute exponentiation mod n 1444 mod 713 = 144 * 144 * 144 * 144 mod 713 = 20736 * 144 * 144 mod 713 = 59 * 144 * 144 mod 713 = 8496 * 144 mod 713 = 653 * 144 mod 713 = 94032 mod 713 = 629 mod 713 20736 * 20736 mod 713 = 59 * 59 mod 713 = 3481 mod 713 = 629 mod 713 This is much more efficient. This still takes too long when the exponent is large.

  28. Repeated Squaring 1442 mod 713 = 59 1444 mod 713 = 1442 ·1442 mod 713 = 59·59 mod 713 = 629 1448 mod 713 = 1444·1444 mod 713 = 629·629 mod 713 = 639 14416 mod 713 = 1448·1448 mod 713 = 639·639 mod 713 = 485 14432 mod 713 = 14416·14416 mod 713 = 485·485 mod 713 = 648 Note that 50 = 32 + 16 + 2 14450 mod 713 = 14432144161442 mod 713 = 648·485·59 mod 713 = 242

  29. Generating Public Key • Choose 2 large prime numbers p and q. • Set n = pq and T = (p-1)(q-1) • Choose e ≠1 so that gcd(e,T)=1 • Calculate d so that de = 1 (mod T) • Publish e and n as public keys • Keep d as secret key How to choose large prime numbers efficiently? Given a large number, how to check whether it is prime efficiently?

  30. Primality Testing Given a large integer n, determine quickly whether n is prime First test: for i =1,…,√n, check if i divides n. We are talking about n with 150 digits. This simply takes too long (2150 steps, sun will burn out). We are looking for an exponential improvement (instead of n, we can only afford roughly log(n) steps), like we did in the extended GCD algorithm. Need some number theory!

  31. Primality Testing Theorem:n is a prime if and only if (n-1)!  -1(mod n) It doesn’t seem to help, since we don’t know how to compute (n-1)!mod n quickly (in roughly log(n) steps).

  32. Primality Testing Theorem: If n is prime & a not a multiple of n 1  an-1 (mod n) Contrapositive. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Example. Show that 1763 is composite (not a prime number). Let a=2, n=1763. 21762 (mod 1763) = 142 ≠ 1 Therefore, it is composite by (the contrapositive of) Fermat’s little theorem.

  33. Primality Testing Contrapositive. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Example. Show that 1387 is composite (not a prime number). Let a=2, n=1387. can not tell whether n is prime or not. 21386 (mod 1387) = 1 Try a=3 31386 (mod 1387) = 1238 ≠1 this shows n is composite.

  34. Primality Testing Contrapositive. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. “Fermat” test Given n, choose a < n Compute an-1 (mod n) Ifan-1 (mod n) ≠1 conclude that n is a composite number Ifan-1 (mod n) =1 try another a Each test takes about log(n) steps. It depends on how many a that we need to try…

  35. Primality Testing Contrapositive. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. “Fermat” test Given n, choose a < n Compute an-1 (mod n) Ifan-1 (mod n) ≠1 conclude that n is a composite number Ifan-1 (mod n) =1 try another a Unfortunately, there exists n which is composite, but an-1 (mod n) =1 for every a! These are called Carmichael numbers (e.g. 561, 1105, 1729, etc…)

  36. Primality Testing Contrapositive 1. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Lemma. If n is a prime number, x2 1 (mod n) if and only if x  1 (mod n) or x  -1 (mod n) Contrapositive 2. If x2 1 (mod n) but x  1 (mod n) and x  -1 (mod n) then n is a composite number. Note that it is (2693)2 Example For n=1387 and a=2, Fermat’s test fails because 21386 1 (mod 1387). However 2693 512 (mod 1387)  1 (mod 1387) By contrapositive 2, we can conclude that 1387 is a composite number.

  37. Primality Testing Contrapositive 1. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Contrapositive 2. If x2 1 (mod n) but x  1 (mod n) and x  -1 (mod n) then n is a composite number. Strong primality test Let n-1 = 2kd Pick an a. Compute a2kd (mod n), a2k-1d (mod n), a2k-2d (mod n),…, ad (mod n) ≠1 Composite by contrapositive 1.

  38. Primality Testing Contrapositive 1. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Contrapositive 2. If x2 1 (mod n) but x  1 (mod n) and x  -1 (mod n) then n is a composite number. Strong primality test Let n-1 = 2kd Pick an a. Compute a2kd (mod n), a2k-1d (mod n), a2k-2d (mod n),…, ad (mod n) =1 ≠1 & ≠-1 Composite by contrapositive 2.

  39. Primality Testing Contrapositive 1. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Contrapositive 2. If x2 1 (mod n) but x  1 (mod n) and x  -1 (mod n) then n is a composite number. Strong primality test Let n-1 = 2kd Pick an a. Compute a2kd (mod n), a2k-1d (mod n), a2k-2d (mod n),…, ad (mod n) =1 =1 Continue to go backward and check

  40. Primality Testing Contrapositive 1. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Contrapositive 2. If x2 1 (mod n) but x  1 (mod n) and x  -1 (mod n) then n is a composite number. Strong primality test Let n-1 = 2kd Pick an a. Compute a2kd (mod n), a2k-1d (mod n), a2k-2d (mod n),…, ad (mod n) =1 =1 =-1 End the test and say it is a “probable” prime.

  41. Primality Testing Contrapositive 1. If 1  an-1 (mod n) and a is not a multiple of n, then n is not a prime number. Contrapositive 2. If x2 1 (mod n) but x  1 (mod n) and x  -1 (mod n) then n is a composite number. Strong primality test Let n-1 = 2kd Pick an a. Compute a2kd (mod n), a2k-1d (mod n), a2k-2d (mod n),…, ad (mod n) =1 =1 =1 =1 =1 End the test and say it is a “probable” prime.

  42. Primality Testing Strong primality test Given n, pick an a Let n’ = n-1 (so n’ is an even number) If an’ (mod n) ≠ 1, then stop and say “n is composite”. n’ := n’/2; While n’ is an integer do If an’ (mod n) = -1, then stop and say “n is a probable prime”. If an’ (mod n) ≠ 1, then stop and say “n is composite”. n’ := n’/2; Stop and say “n is a probable prime”.

  43. Primality Testing For a particular a, the strong primality test takes “about” log(n) steps. But again, there exists n which is composite but pass the test… Theorem: if n is composite, for more than half of a < n, the strong primality test will say n is composite! So, given a composite n, if we pick a randoma, the strong primality test will be incorrect with probability <= 1/2. Thus, if we repeat the procedure for 10000 times, then the probability that the strong primality test is still incorrect is very small (e.g. much smaller than our computer will suddenly crash). This is the most efficient method used in practice!

  44. Generating Public Key • Choose 2 large prime numbers p and q. • Set n = pq and T = (p-1)(q-1) • Choose e ≠1 so that gcd(e,T)=1 • Calculate d so that de = 1 (mod T) • Publish e and n as public keys • Keep d as secret key Similar idea Prime number theorem: From 1 to n, there are roughly n/log(n) prime numbers. How to choose large prime numbers efficiently? Pick a random large number, do the (randomized) strong primality tests, until we find a prime!

  45. Remarks • We have derived everything from basic principle. • RSA cryptosystem is one of the most important achievements in compute science. • (The researchers won the Turing award for their contribution.) • Number theory is also very useful in coding theory (e.g. compression). • Mathematics is very important in computer science.

  46. More Remarks Theorem: if n is composite, for more than half of a < n, the strong primality test will say n is composite! The proof uses Chinese Remainder theorem and some elementary number theory. (Introduction to Algorithms, MIT press) Conjecture: It is enough to try a to up to roughly log(n). Theroem (Primes is in P, 2004) There is an efficient and deterministic primality test. Major Open Problem: Is there an efficient algorithm to compute the prime factorization?

  47. Midterm • Homework 2 to be posted today, deadline Oct 30 (5pm). • Homework 1 solutions to be posted soon. • Midterm on Nov 2 (in class, 90 minutes). • Cover proof/logic and number theory. • True/False, MC, short questions, long questions. • Relatively easier than homework. • Useful to work on supplementary exercises. • Calculator needed.

More Related